Source code for keystone.common.sql.data_migration_repo.versions.003_migrate_unencrypted_credentials

# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

import sqlalchemy as sql

from keystone.credential.providers import fernet as credential_fernet

[docs]def upgrade(migrate_engine): meta = sql.MetaData() meta.bind = migrate_engine session = sql.orm.sessionmaker(bind=migrate_engine)() credential_table = sql.Table('credential', meta, autoload=True) credentials = list( for credential in credentials: crypto, keys = credential_fernet.get_multi_fernet_keys() primary_key_hash = credential_fernet.primary_key_hash(keys) encrypted_blob = crypto.encrypt(credential['blob'].encode('utf-8')) values = { 'encrypted_blob': encrypted_blob, 'key_hash': primary_key_hash } update = credential_table.update().where( == ).values(values) session.execute(update) session.commit() session.close()